Users login with user@domain-label to authenticate via that domain's authdb.
Select a group from authdb. Users in this group get read/write access to this store.